I would reference Coda's write up of this, I think it's better: http://codahale.com/a-lesson-in-timing-attacks/ I'd also include a bit more about when you should use it. (Whenever you're comparing user supplied data with secret data)